Implement compat search through SkillSearchAppService instead of returning an empty placeholder list, and map search results back to canonical slugs for the compatibility API.
Replace hard-coded admin user and audit-log payloads with repository-backed application services. User management now supports paged search and status filters, validates managed statuses and role codes, prevents USER_ADMIN from assigning SUPER_ADMIN, and persists role/status changes against the real repositories. Audit logs now read from the audit_log table through a dedicated query repository/service with filterable pagination.
Align admin response DTOs with the frontend contract, add domain not-found handling for localized 404 responses, and cover the new behavior with controller and service regression tests. Verified with targeted skillhub-app tests plus full server mvn test.
- require authentication for skill star and rating GET endpoints before the public skill-read rules
- keep documented public skill detail, version, download, resolve, and tag listing endpoints readable anonymously
- add regression coverage for anonymous star and rating access denial plus public tag listing
- parse stored api token scopes and attach SCOPE authorities during authentication
- reject disabled users from establishing api token sessions and stop touching last-used for inactive accounts
- add an api-token-only scope filter that limits tokens to documented publish and token-management endpoints
- add shared package safety policy for path normalization and size limits
- stream zip extraction for cli check and publish flows to reject traversal and oversized entries
- confine local storage keys to the configured base path and add regression coverage
- stop publish submission from advancing skill.latestVersionId or overwriting published-facing skill metadata while a version is still pending review\n- move latest pointer and display metadata promotion into review approval so the public skill record changes only when a version becomes PUBLISHED\n- keep SkillPublishedEvent emission on review approval only, preserving search rebuild semantics for published versions\n- add regression coverage for pending review submissions retaining published metadata and for approval promoting latest pointer plus display fields
- derive review namespace from skill ownership instead of trusting request input\n- require namespace membership for review submission and owner or namespace admin rights for promotion submission\n- forbid unauthorized pending-list and detail reads in review and promotion portal endpoints\n- add domain and controller regression tests for submit and read permission boundaries
- IdempotencyInterceptor: restructure Redis check to avoid swallowing
exceptions inside try-catch, use ApiResponse envelope for 409 response
- IdempotencyInterceptorTest: register JavaTimeModule for Instant
serialization, align mocks with actual implementation
- SkillRatingServiceTest: update expected exception type to match
DomainBadRequestException used in entity and service
- Add rating value validation in SkillRating entity
- Improve SkillRatingService error handling
- Add SkillPublishService and SkillQueryService test coverage
Add dev-all/dev-all-down for starting full local environment with
health checks. Fix dev-server to target skillhub-app module. Remove
unused prod-up/prod-down/logs targets.
- Add admin users management page with role and status controls
- Add audit log page with filtering capabilities
- Create useAdminUsers and useAuditLog hooks for API integration
- Add route guards for USER_ADMIN, AUDITOR, and SUPER_ADMIN roles
- Register /admin/users and /admin/audit-log routes
- Add IdempotencyRecord entity with status tracking (PROCESSING/COMPLETED/FAILED)
- Implement IdempotencyInterceptor for request deduplication via X-Request-Id header
- Add scheduled cleanup tasks for expired and stale idempotency records
- Create admin API endpoints for user management (list/update role/update status)
- Create admin API endpoints for audit log viewing with filtering
- Add comprehensive unit tests for all components
- Configure test Redis mocks to support idempotency layer
- Add TestRedisConfig with mock RedisTemplate bean
- Restore DeviceAuthService as normal @Service (no conditional)
- Restore controllers as normal @RestController (no conditional)
- Remove DeviceAuthConfig and DeviceAuthWebConfig (not needed)
- All 179 tests pass
- Server Dockerfile: add Maven dependency caching layer for faster rebuilds
- Add .dockerignore for server and web to reduce build context
- Add docker profile to application.yml for container env var mapping
- Makefile: add help, logs, db-reset targets with ## annotations
- Remove auth_method field reference, use local_credential existence
- Unify merge API path to /api/v1/auth/merge/*
- Add missing /.well-known/ proxy in Nginx and K8s Ingress
- Fix SeedDataRunner missing field declarations
- Remove login failure attempt count from error response
- Sync delivery roadmap Phase 4/5 scope with spec
- Add submitPromotion with duplicate check and validation
- Add approvePromotion with optimistic locking and skill copying
- Add rejectPromotion with reason recording
- Add submitReview with duplicate check via partial unique index
- Add approveReview with optimistic locking and event publishing
- Add rejectReview with reason recording
- Add withdrawReview with PENDING status check
